Versitygw

A versitygw S3 gateway for swamp, read over its admin API and its S3 API. Read-only. One model type, @dataverket/versitygw/gateway. health checks the S3 endpoint's health path: reachable, TLS verified, latency. accounts lists every account with its role and POSIX ids, and drops the secret key the admin API returns in clear before anything is recorded. buckets lists every bucket and its owner. bucketSettings reads each bucket's versioning, policy, ACL, object lock, ownership controls, CORS and tags over the S3 API. inventory does all of that in one execution and tags every record with one id, and check applies rules to the records of one inventory: bucket owner missing or not the account of the same name, an account owning nothing, a role outside the allowed set, versioning without object lock, lock without versioning, a default retention mode outside the allowed set, a bucket anyone may read. The same type reads a Ceph radosgw through its admin ops API (backend: rgw) or any S3 endpoint with one key pair (backend: s3); the bucket settings and the rules over them are plain S3 and the same everywhere. versitygw has no read-only admin role, so every admin call signs with the root key pair, from exactly one source: a file of NAME=value lines read at call time, swamp's environment, or the pair as values from vault expressions, so the definition stores only the reference. Signing is SigV4 by aws4fetch; errors are the gateway's S3 error codes. Written against versitygw v1.8.0.